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As quantum key distribution becomes a mature technology, it appears clearly that some assump- 
tions made in the security proofs cannot be justified in practical implementations. This might open 
the door to possible side-channel attacks. We examine several discrepancies between theoretical 
models and experimental setups in the case of continuous-variable quantum key distribution. We 
study in particular the impact of an imperfect modulation on the security of Gaussian protocols and 
show that approximating the theoretical Gaussian modulation with a discrete one is sufficient in 
practice. We also address the issue of properly calibrating the detection setup, and in particular the 
value of the shot noise. Finally, we consider the influence of phase noise in the preparation stage of 
the protocol and argue that taking this noise into account can improve the secret key rate because 
this source of noise is not controlled by the eavesdropper. 

PACS numbers: 03.67.-a, 03.67.Dd 



Quantum Key Distribution (QKD) is a cryptographic 
primitive allowing two distant parties, Alice and Bob, to 
distill secret keys in an untrusted environment controlled 
by an eavesdropper, Eve pQ. Among quantum informa- 
tion technologies, QKD is one of the most advanced, and 
reaches already commercial applications. The main argu- 
ment in favor of QKD is its provable security based on the 
laws of quantum mechanics; it is therefore particularly 
important to make sure that the security proofs derived 
for theoretical protocols can be applied to real- world im- 
plementations. This is unfortunately never really the 
case because the security proofs usually assume idealized 
implementations, which do not take into account all pos- 
sible experimental imperfections. This opens the door to 
potential security loopholes [2] that might be successfully 
exploited by an attacker. Such side-channel attacks have 
already been demonstrated against commercial QKD sys- 
tems iig. 

There are basically two ways around side-channel at- 
tacks. A drastic solution consists in deciding that the sys- 
tems held by Alice and Bob should not be trusted: this is 
the device-independent paradigm, based on the violation 
of a Bell inequality |oj . While being appealing in theory, 
this paradigm does not offer a practical solution since 
violating a Bell inequality in a loophole-free fashion has 
not been achieved until now. A more practical way to ad- 
dress side-channel attacks aims at refining the theoretical 
models used for security proofs in order to include various 
sources of experimental imperfections. This involves, for 
instance, developing better models for the state prepa- 
ration, including the light source, the modulation, and 
the noise, and for the detection, including the quantum 
efficiency and the calibration of the noise. 

In this paper, we follow the second approach in the case 
of Continuous- Variable (CV) QKD protocols. The main 
specificity of these protocols is that they use a homodyne 
detection instead of single-photon counters, which makes 



them attractive from a practical perspective. Moreover, 
they are compatible with Wavelength Division Multiplex- 
ing [5J, which is an important advantage when it comes 
to integrating QKD in real- world telecommunication net- 
works. CVQKD protocols are proven secure against co- 
herent attacks [THS] and, asymptotically, the secret key 
rate is given by the Devetak- Winter formula [TH] E] cor- 
responding to collective attacks [HI [T3] . At the theoret- 
ical level, CVQKD protocols therefore present the same 
level of security as those based on photon counting, such 
as BB84 [H]. 

Here, we focus on Gaussian prepare-and-measure 
CVQKD protocols, which have already been demon- 
strated experimentally fTSll2"2"] (see [53] for a recent re- 
view of all CVQKD protocols). In particular, we con- 
sider the GG02 protocol [21] where Alice generates coher- 
ent states with a Gaussian modulation, and sends them 
to Bob who performs a homodyne measurement for a 
randomly chosen quadrature. By repeating this process 
a large number of times, Alice and Bob obtain corre- 
lated classical data, from which they can extract identi- 
cal strings through the process of reconciliation [25] and 
then obtain a secret key using privacy amplification. 

We study three kinds of imperfections that occur in all 
implementations of this protocol and see how they affect 
its security and the secret key rate. The first imperfection 
concerns the modulation, which, in practice, can only 
approach the theoretical Gaussian modulation. Indeed, 
a Gaussian distribution is not only continuous but un- 
bounded, and therefore cannot be exactly achieved since 
for instance, an infinite amount of randomness would be 
required. We show that the impact on security is not 
significant when the Gaussian distribution is replaced by 
a bounded, discrete approximation. However, deviations 
from a perfect discretized distribution degrade the se- 
curity. The second source of imperfection comes from 
finite-size effects, and in particular from the calibration 
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of the detection setup. While a first study in this di- 
rection has already considered statistical estimation of 
the transmittance and excess noise of the channel [55] , it 
assumed that the quantum efficiency and the electronic 
noise of the detection, and more importantly, the shot 
noise level, were all perfectly calibrated. Here, we con- 
sider these effects in detail and examine their impact on 
the secret key rate and distance. Finally, we study the 
effect of phase noise in the preparation process of the 
protocol. This noise is unavoidable but one can safely 
assume that it is not controlled by the eavesdropper. We 
therefore show that by calibrating it properly, one can 
increase the secret key rate of the protocol. 

The three kinds of imperfections are discussed in Sec- 
tions I, II, and III of the paper, respectively. 
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SECURITY OF GAUSSIAN PROTOCOLS 
WITH AN IMPERFECT MODULATION 



We first consider an issue present in all implementa- 
tions of CVQKD with a Gaussian modulation, namely 
that it is impossible to use an exact Gaussian modula- 
tion in practice. In the ideal scenario for the prepare- 
and-measure protocol, for each signal to be sent, Al- 
ice is supposed to draw two random normal variables 
q,p ~ jV(0, Va) and to prepare the coherent state \q + ip) 
centered on the point (q,p) in phase space. Unfortu- 
nately, in practice, ignoring phase noise, the coherent 
state really prepared by Alice is centered on (q' ,p r ) in- 
stead, where (q',p') is a point on a finite grid, approxi- 
mating the ideal value of {q,p). This is unavoidable for 
several reasons. First, the analog-to-digital converters 
that drive the physical modulators used in practice pro- 
duce discrete voltages; they typically have a bit depth of 
10 like in |20| . Second, intensity modulators only work in 
some finite range of values, whereas the Gaussian distri- 
bution is unbounded. Another hardware constraint is the 
throughput of the physical Random Number Generators 
(for example Quantis, from ID Quantique, is limited to 
16 Mbit/s). But there are also software limitations: one 
does not want to use too much randomness in order to 
draw the Gaussian variables q and p out of the uniform 
variables provided by the physical Random Number Gen- 
erator because this requires computational power. For 
these reasons, it is useful to know how well the Gaussian 
modulation needs to be approximated in order to get a 
reasonably good level of security. 

Intuitively, the presence of shot noise hides the small 
imperfections of the modulation and the security should 
not be compromised provided that the grid of (q' \p') is 
sufficiently fine-grained compared to the value of the shot 
noise. Figure [l] illustrates how fine the grid needs to be 
compared to the shot noise. 

In order to analyze the security of the practical pro- 
tocol, it is convenient to look at the situation from Bob 
and Eve's points of view. In the theoretical protocol, the 
state sent by Alice to Bob should be a thermal state from 



Figure 1: Discretization grid used to approximate a Gaussian 
modulation in phase space. The modulation variance Va is 
chosen to be equal to the shot noise No. The distribution is 
truncated to 7 standard deviations and discretized in steps 
of l/4 th of shot noise units. A coherent state of variance No 
covers a large part of the grid, which results in hiding the 
small imperfections of the discretized modulation. 



Eve's perspective, that is a Gaussian mixture of coher- 
ent states. If Eve cannot distinguish the state sent in 
practice from a thermal state, then clearly the security 
of the protocol is not compromised by the approximated 
modulation. More precisely, if the trace distance between 
the ideal state and the actual state is bounded by e prcp , 
and if the usual protocol (with perfect state preparation) 
is e-secure, then the true protocol is (e + e prop )-secure. 
Therefore, one simply needs to ensure that e prep can be 
made quite small, that is on the order of 10 -10 in a real- 
istic implementation. 



A. The quality of a Gaussian modulation 

Let us write p = p t h = 2_^i — f/m+i f ne ideal 

thermal state and a = ^""^ uik\a>k){ak\ the state used 

fe 

in practice. Here uj^ corresponds to the probability of 
preparing the coherent state \otk)- 

We will compute the trace distance \\p — a\\\ between 
the two states, for two discretizations er, either with a 
cartesian or a polar grid. For both discretizations, we 
will use the gentle measurement lemma [27l EE] : 

Lemma 1 (Gentle measurement). Let p be a state and 
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II be a projector. Then 

\\ P - u P u\ \ < 2v/i-tr {n P n). 



(i) 



Let us take n = |0)(0| + |1)(1| + •• • + \Q - 1){Q - 1|. 
The triangle inequality gives: 

Hp-^II < llp-npnii + iinpn-ncrnii + nncrn-crii 
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0<ra<m<Q 0<n<Q 

three quantities can be estimated from the terms 
(n\a\m) , < n, m < Q. 

Notice that R p := does not depend on the ac- 

tual approximation used, but only on the mean photon 
number x of the ideal thermal state. When using a Gaus- 
sian modulation of variance Va (in shot noise units), one 
has x = IV a- This means that larger values of Va re- 
quire larger values of Q in order to obtain a good bound 
in Eq. ((2). A typical range for V A is [1, 20]. For V A = 20, 



and i 



prep 



= 10 , one needs to have Q ~ 1000 to ensure 



that R p < e prep . Furthermore one also needs R a < ep rep , 
which puts additional constraints on Q. 



B. Cartesian approximation 



Here, we consider an approximation of the form 
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«fci = <Zfe + ipfc, and A, Af are two parameters to 
be optimized. The \au) are coherent states: \a) — 



Therefore, 

(n\a\m) = E ^k^i (n\ a ki) (ctki\m) 



N 



k,l=-N 
N 



= E "kUte-^^L . 

From this expression, Adiag, A non di ag and R a can be eval- 
uated numerically for any choice of x = 2Va, Q, A and TV. 
Once A is chosen, TV is typically set so that 6 = A/N, 
the discretization step, has some predetermined value. 
Given Va, let us show that a low e prC p = \\p — a\\ can 
be obtained with reasonable values of A and N. Assume 
Va = 20, a rather large value corresponding to a Gaus- 
sian modulation of standard deviation \/2Q; use (see Fig. 



• A — 7-v/Va, meaning that the actual Gaussian dis- 
tribution is truncated to 7 standard deviations; 

• N = [~4A] , meaning that the distribution is dis- 
cretized in steps of l/4 th of shot noise units. 

These choices can be used in practice: for Va = 20, they 
require 2 x [4 x 7 x \/Va \ + 1 = 253 discretization steps, 
that is, an 8-bit discretization grid. The entropy of the 
corresponding pair of discretized Gaussian values is 2 x 
6.2 = 12.4 bits. Source coding techniques enable to use 
on average no more than this randomness quantity when 
drawing them in practice. 

For Q — 2000 (chosen to get a sufficiently low value of 
R a ), a numerical evaluation yields 



A,. 



A diag < 1.02 10" 
< 1.04 10" 
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^noiidiag 

R„ < 1.09 10 
from which we deduce 

Hp -o-|| < 3.3i io~ n 



(4) 
(5) 
(6) 

(7) 



In the above discretization scheme, the mass lost be- 
cause of the distribution cutoff is evenly distributed 
among the remaining coherent states. Let us give a sim- 
ilar result for a slightly different cutoff scheme where the 



lost mass is added to uj±n only: u>k = 
for —TV + 1 < i < N - 1, and uj- N 



'1-kV 
UJ N 



-9»/(2V) 
= (I" 



Y^i— -jy+i UJ k)/2- For this scheme with the same param- 
eters as before, we find 



\p-<r\\ < 2.98 10 



-li 



(8) 



C. Polar approximation 

The actual modulation devices implement a polar mod- 
ulation because phase and intensity are modulated sep- 
arately. It is therefore natural to investigate the dis- 
cretization required in polar coordinates to obtain a good 
approximation of a thermal state. 
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Let us assume that the polar coordinates are dis- 
cretized uniformly on [0,R] x [0, 2ir}. Let us note the 
discretized values as: 



v= (l + l) ^,le[o,L-i]. 



(9) 
(10) 



We consider then an approximation of the form 

o- = j^2^k^2\a k i) (a k i\, (11) 



where uj k — ^-- 7fc 
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= r k e- r i/W and \a M ) = 
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and J7„ 



(12) 

(13) 

(14) 
= 



With t/„ m ,L 

otherwise. 

Unfortunately, this polar discretization requires a finer 
discretization than the cartesian one for the same ap- 
proximation quality. For instance, with Va = 20 as be- 
fore, using Q = L = 2000 (thus eliminating the term 



A 



nondiag 



altogether in Eq. (p|) and R 



bit discretization of the amplitude is required to obtain 
|(0|p|0) — (0|<r|0)| < 10 -10 . Drawing values correspond- 
ing to this discretization uses 11 bits for the angle and 
15.5 bits for the modulus on average. This situation 
can be improved by using instead of regularly spaced 
r-fc, points placed according to the Gauss quadratures 
method, especially the Gauss-Hermite variant: an 9-bit 
amplitude discretization entropy is found to be sufficient 
for e prcp < 10~ 10 . This is still slightly worse than the 
Cartesian grid, but could be improved further by making 
the angle discretization depend on the amplitude, as less 
points are needed in the vicinity of the origin. 



D. Robustness of bounds 

An important question related to the discretization is 
the robustness of the bounds given in the previous sec- 
tions when the discretization grid is disturbed by some 
small systematic error term. This can happen, for in- 
stance, because of calibration errors or because of com- 
plex discretization effects due to the experimental setup. 
For example, an amplitude modulator generally produces 



an amplitude A = cos(cU+0), where V is the voltage ap- 
plied to it; since V is discrete, the modulated amplitude 
values are projected to a set that is the image of the dis- 
crete set of attainable voltages by the functional realized 
by the modulator. To model the effect of these errors, we 
added a small disturbance with Gaussian distribution of 
standard deviation er error to each point of the cartesian 
grid, and numerically computed the resulting e prcp . With 
parameters as in Section I B we get a\\ w 0.1xcr error . 

io- 



This shows that obtaining e p 



< 



-10 



m practice may 



10" 



or 



be difficult; it is more realistic to expect e pr( 
10~ 5 . 

It is true that the proof techniques used today force us 
to include e prep in the final security parameter of the key, 
but it is plausible that this is too pessimistic. Indeed, it 
is known that protocols with a non-Gaussian modulation 
are secure against all attacks corresponding to a linear 
channel between Alice and Bob [29 . This gives a hint 
that approximations of the order of 10 -4 or 10~ 5 might 
be sufficient in practice. 



II. IMPERFECT CALIBRATION OF THE 
DETECTION SETUP 

We consider now finite-size effects related to the detec- 
tion setup. We note that a proper calibration of Alice and 
Bob's devices is crucial to prove the security of the final 
key [3U] ■ Our goal is to improve and expand the analysis 
of Ref. [26] concerning finite-size effects in CVQKD [40] . 
In particular, the values of the quantum efficiency and 
the electronic noise of Bob's Homodyne Detection (HD) 
can only be estimated up to some finite precision. These 
inaccuracies must be taken into account when comput- 
ing a secret key rate compatible with a realistic scenario 
(where these sources of noise are not assumed to be con- 
trolled by Eve) while considering finite-size effects. In 
the same way, the modulation variance on Alice's side 
and the excess noise on Bob's side both need to be es- 
timated, in shot noise units, when computing the secret 
key rate. This implies that any imperfect precision on 
the estimation of the shot noise has an impact on the 
secret key rate. 

The effect of a noisy HD has already been taken into 
account in the security proofs [TTJ, fSU] . The efficiency of 
the detection is modeled by a beamsplitter of transmit- 
tance rj and the electronic noise is modeled by a thermal 
noise of variance N e \ added at the second input of the 
beamsplitter. That is, before Bob's HD, the state re- 
ceived by Bob is mixed with a thermal state of variance 
N e \ on a beamsplitter of transmittance r). The variance 
of the electronic noise of the HD, v c \, is linked to N e \ by 
W e l = (1 ~ 77) (iVei — 1). Interestingly, the final key rate 
depends only on one parameter, namely the added noise 
referred to the input of the measurement device, denoted 
as Xhom = ^-f^Nci = +" el — 1. Therefore, all the com- 
binations of the parameters (77, iy) that give the same 
Xhom have the same impact on the secret key rate. 
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In [2U], these parameters were supposed to be cali- 
brated in a secure lab, which implies that no attacker can 
interfere with the calibration procedure. Since this cali- 
bration is not performed during a QKD run, the statisti- 
cal noise due to the finite number of samples used for the 
estimation can be made arbitrarily small. However, both 
parameters are still known imperfectly because of the fi- 
nite precision of the measurement apparatuses. Here we 
consider an imperfect knowledge of these parameters and 
its effect on the secret key rate. 

In order to calibrate a fiber-based HD, like the one 
used in [20] . one should in fact estimate three quantities: 

• the interferometer mode matching 77 mo( j with pre- 
cision A?7 mod , 

• the efficiency of the photodiodcs ?7phot with preci- 
sion A?7 phot , 

• the fiber optic transmittance 77 opt with precision 
A?7 pt. 

Then, the HD efficiency reads r\ = f^od^phot^opt [H] and 
the overall uncertainty is: 

Av = J 2 A ^ + A ^ + A ^\ (15) 

\ ffciod ?7phot ?7opt / 

The interferometer mode matching efficiency n mo d is 
close to 99%, while a typical value for 7? p hot is 80% with 
the PIN photodiodes used in [20]. The fiber optic trans- 
mittance is usually low (around 80% for fiber-based HD 
since losses are usually applied on one arm of the interfer- 
ometer to compensate for an unbalanced beamsplitter). 

As far as v e \ is concerned, this is estimated as the vari- 
ance of the HD electronic noise, i.e., the detection out- 
put variance when no optical signal enters the detection 
device. This noise is mainly due to the thermal noise 
introduced by the load resistance at the entrance of the 
amplifier circuit (the intrinsic noise of the photodiodcs 
is typically negligible). A straightforward way to deter- 
mine v e i is to measure it directly as the variance of the 
HD output when no light enters the homodyne detection. 
Alternatively, one can plot the relationship between the 
power of a light source entering one branch of the beam- 
splitter of a balanced shot-noise limited HD and the vari- 
ance of the HD output, when the other entrance of the 
HD is disconnected. This relationship should be linear, 
the Y-intercept being the variance of the electronic noise. 
Experimentally, the latter method leads to less accurate 
values of the electronic noise. However, even with the 
direct method v e \ can only be known up to a precision 
Av e \. 

The different uncertainties mentioned above can be 
evaluated depending on the measurement procedure and 
the precision of the measurement devices. In a practi- 
cal CVQKD setup, Alice and Bob estimate the quan- 
tities required to compute the secret key rate through 
the sampling of m = N — n pairs of correlated variables 
(xi,yi)i=i... m , where N is the total number of quantum 



signals sent through the quantum channel and n is the 
number of signals used for the key establishment. 

More precisely, the parameter estimation is performed 
in two steps. First, after the state distribution and mea- 
surements, Alice and Bob need to roughly estimate the 
signal-to-noise ratio of their classical data in order to 
choose the proper error correcting code for the reconcil- 
iation [25] . This typically requires m = 0{yN). Then, 
after the (reverse) reconciliation, Alice knows both her 
raw string and the one received by Bob. In practice, Al- 
ice and Bob would publicly compare a small hash of their 
final string to make sure that the reconciliation procedure 
succeeded. The size of these strings is N and the parame- 
ter estimation can be performed on the whole string. The 
results of this estimation will be used to compute a tight 
bound on Eve's information about Bob's string. 

Since for CVQKD, it is sufficient to estimate the co- 
variance matrix of the state shared by Alice and Bob, 
the only parameters that need to be estimated are the 
variance on Alice's and Bob's sides, respectively (x 2 ) and 
(y 2 ), and the covariance between Alice and Bob (xy) (as- 
suming here that x and y are centered variables, that is, 
that (x) — (y) = 0). These values are linked to the key 
rate parameters through: 

(x 2 ) = Va (16) 
(y 2 ) = V TV A + N + V n + v el (17) 
(xy) = yfijiV A , (18) 

where T is the quantum channel transmittance, Va is the 
modulation variance, £ is the excess noise, and Nq is the 
shot noise (all expressed in their respective units and not 
in shot noise units as it is usually assumed). 

Since r\ and v e i are calibrated beforehand, one has four 
unknown parameters (Va,Nq,T,^) and only three equa- 
tions. However, by forcing a quantum channel with zero 
transmittance, we get one more equation: 

(yo 2 ) =N + v cl . (19) 

This can be done in Bob's laboratory by measuring the 
vacuum. 

In order to compute confidence intervals for these pa- 
rameters, we consider here a normal model for Alice and 
Bob's correlated variables (xi, yi)i=i...jv : 

y = tx + z, (20) 

where t = \/rjT G K and where z follows a centered 
normal distribution with unknown variance a 2 = Nq + 
nT^ + v c \. Note that this normal model is an assumption 
justified in practice but not by current proof techniques, 
which show that the Gaussian assumption is valid once 
the covariance matrix is known [121 113] . Exploiting sym- 
metries of the protocol in phase-space might be a way to 
rigorously justify this assumption [311 132] . The random 
variable X is a normal random variable with variance Va 
in the case of a Gaussian modulation. Another set of 
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Bob's data (yoi)i=i...N' can be used to measure the noise 
when no signal is exchanged (one can take N' to be on 
the order of N): 



yo = z 



(21) 



where zq follows a centered normal distribution with un- 
known variance a 2 = Nq + v c \. Similarly to the analysis 
in |26) . Maximum-Likelihood estimators t, a 2 and tf 2 
are known for the normal linear model: 



t = 



L^i=\ x iVi 
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V A = 
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(22) 
(23) 
(24) 
(25) 
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Figure 2: Secret key rate for collective attacks including finite- 
size effects and calibration imperfections with respect to the 
distance for different values of the number of samples. The 
transmittance T and distance d are linked with the expression 
T = io- Qd / 10 , where a is the loss coefficient of the optical 
fiber. Va = 2.5, £ = 0.01, 77 = 0.6, v cl = 0.01, a = 0.2 
dB/km, p = 95%, Ar; = O.I77, A« e i = 0.1w e i, e = lO" 10 , 
TV = asympt, 10 10 , 10 9 , 10 s , 10 7 , 10 6 from top to bottom. 



The estimators i, a 2 , cr 2 and Va are independent esti- 
mators whose distributions are: 



Na 2 N'a 2 NV A 



X 2 (m-1) 



(26) 
(27) 



where t, cr 2 , cr 2 and Va are the true values of the pa- 
rameters. In the limit of large N,N', one can compute 
confidence intervals for these parameters: 



Once the parameters and their respective confidence 
intervals have been determined, one can in particular ex- 
press in shot noise units all the quantities needed to com- 
pute S epE (y : E), the maximal value of the Holevo infor- 
mation between Eve and Bob's classical data compatible 
with the statistics except with probability epE- Thus, 
the secret key rate for collective attacks including all the 
finite-size effects and calibration imperfections discussed 
previously can be computed as: 



te[i- AT, i + AT] 
a 2 G [a 2 -Aa 2 ,a 2 + Aa 2 ] 
<t G [a - Acr , <t + Aa \ 
V A G [V A -AV A ,V A +AV A ] 



(28) 
(29) 
(30) 
(31) 



where AT = z tpE / 2 

■ AV A = 



NV A 



Aa 2 



z, 



Aa 2 



is such that 



1 — erf(z £j , E / 2 /v / 2)/2 = £p_e/2. Here we have used the 
error function erf(x), defined as: 

2 f x 2 
erf(x) = -= er t2 dt. (32) 



One can then estimate T — — and £ — a - 9 CTo using the 
previous estimators and their confidence intervals. As 
regards the shot noise, it is known with a precision that 
depends both on the number of samples used to compute 
the estimator (Tq and on the precision on the electronic 
noise Av e \. 



-^finite = Jt{P!( x : V) 



S epE (y : E) - A(n)), (33) 



where (3I(x : y) is the amount of mutual information Al- 
ice and Bob were effectively capable to extract through 
the reconciliation phase (j3 is the reconciliation efficiency 
which ranges from when no information was extracted 
to 1 for a perfect reconciliation scheme) and A(n) is re- 
lated to the security of the privacy amplification [551 123] • 

Figure [2] gives the secret key rate for various values of 
the number of samples N — N' . It appears that even 
taking pessimistic confidence intervals for r\ and v e i, for 
example with Arj = O.I77 and Av c i = 0.1w e i, the impact 
on the secret key rate is not significant. However, a high 
precision on the shot noise is required for long distances 
since rjT^ must be known with a high precision as al- 
ready observed in [2 6) . It is worth noting that even using 
10 6 samples leads to a positive secret key rate for the 
Gaussian protocol unlike discrete modulation protocols 
for which at least 10 s samples are required [2"6] . 
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III. IMPROVED KEY RATE WITH PHASE 
NOISE CALIBRATION 

In order to obtain precise statements about the secu- 
rity of a given quantum key distribution (QKD) protocol, 
it is useful to carefully characterize the equipment of Al- 
ice and Bob. For CVQKD, this issue has already been ad- 
dressed extensively for the detection stage. In particular, 
as was discussed in the previous section, in a calibrated 
device scenario, the detection model includes a finite 
quantum efficiency and a given level of electronic noise. 
Interestingly, both these imperfections act as sources of 
noise that can be trusted, in the sense that they are not 
controlled by Eve. This corresponds to the so-called real- 
istic model, as opposed to the paranoid model where the 
eavesdropper is supposed to control all sources of noise. 
The realistic model allows one to derive a secret key rate 
that is actually better than the one obtained without this 
modeling for the imperfections of Bob's detection. 

Concerning the preparation phase of the Gaussian 
CVQKD protocol that we are considering, recent work 
has addressed the issue of imperfections in Alice's state 
preparation. In particular, Refs [3"4"H3"6] studied the situ- 
ation where Alice in fact prepares thermal states instead 
of coherent states. In fact, it is even possible to achieve 
CVQKD in the microwave regime where the preparation 
of pure coherent states is impossible [37J I3E|- O ne re- 
mark about these works is that they consider a specific 
kind of imperfection that can be efficiently dealt with ex- 
perimentally (at least in the optical regime). Indeed, if 
Alice really prepares thermal states instead of coherent 
states, one simple solution is to increase the variance of 
modulation and then to strongly attenuate the resulting 
state in order to obtain something very close to a co- 
herent state. For this reason, the problem of preparing 
thermal states instead of coherent states is not really an 
issue in a practical scenario. 

A more relevant issue concerns non-Gaussian sources of 
noise. In particular, there always is some phase noise on 
the state prepared by Alice. A typical value for the vari- 
ance of this noise is 10~ a Nq per photon in the pulse [39] , 
One cannot suppress this noise by increasing the vari- 
ance of the modulation and then attenuating the state, 
as mentioned above. Studying this noise is therefore of 
particular theoretical interest and of importance for ac- 
tual experiments. 

An important property of this noise is that it leaves the 
global state Pb = ^aPab sen t by Alice in the quantum 
channel (and therefore seen by Eve) invariant. This is 
different from the thermal noise considered in [351 136j . 
which increases the variance of ps - In particular, this 
means that this noise can be modeled as an imperfect 
measurement for Alice in the entanglement-based equiv- 
alent protocol. In that picture, Alice prepares two-mode 
squeezed vacuum states, sends one mode to Bob and mea- 
sures the other one with a heterodyne detection. When 
modeling the noise, one can keep the preparation of two- 
mode squeezed vacuum states, and only Alice's detection 



will be noisy. This simply means that the classical data 
that she gets is noisy (with some phase noise). Therefore, 
the only consequence of this noise is that it degrades the 
mutual information shared between Alice and Bob, but 
it cannot increase Eve's information about Bob's mea- 
surement outcome, which is of interest in a reverse rec- 
onciliation scheme. 

More specifically, in this case, the secret key rate 
against collective attacks is K asympt = j3I(x : y) — x(y '■ 
E), where /3I(x : y) is defined as in the previous section 
and x{y '■ E) is an upper bound on Eve's information on 
Bob's measurement outcomes. Because one can model 
phase noise as a local noise acting on Alice's system, it 
can only decrease the quantity I(x : y) but cannot help 
the eavesdropper by increasing x(y '• E). In such a sce- 
nario, one can expect that the phase noise can be removed 
from the excess noise when computing Eve's information, 
leading to a realistic model for the preparation stage, sim- 
ilarly to the detection stage. This should lead to better 
secret key rates in practice. 



A. Model for the phase noise 

The phase noise can be modeled as applying a phase 
rotation U{9) = ey^{i9a) a) on Alice's mode with a ran- 
dom phase 9 characterized by some probability distribu- 
tion p(6). This means that when Alice tries to prepare 
some coherent state \a) in the prepare- and-measure pro- 
tocol, she actually prepares a state with a noisy phase: 
p a = JU{9)\a)(a\U(9)'<p(9)d9. Let us assume that Al- 
ice initially prepares an ideal two-mode squeezed vac- 
uum state with a variance Va- This state pidcai has the 
following covariance matrix (for a displacement vector 

[qA,PA,qB,PB] T )- 



ideal 



V A 1 2 Wa z 
Wa z V A 1 2 



(34) 



where W := \/V\ — 1 and a z = diag(I, —1). 

Applying a local phase shift U (9) on Alice's mode gives 
a state with a covariance matrix T(ff) given by 



T{9) 



V A Wcos9 Wsm9 

V A Wsm9 -W cos9 
Wcos9 Wsin9 V A 
Wsin9 -Wcos9 V A 



(35) 

Finally, the state affected by the phase noise is a clas- 
sical mixture of states with random phase shifts p = 
J (U A (9) ® ls)pidcai(^A(^) f ® l B )p(0)d9, and its covari- 
ance matrix is 



phase noise 



V A li V^Wa z 
/nWa z V A 1 2 



(36) 



where we assumed that the distribution 9 is symmetric, 
and more precisely that J p(9) sin9d9 = 0, and intro- 
duced k := (J p(9)cos9d9) 2 = (£[cos6>]) 2 , where E[X\ 
is the expectation of the random variable X. 



The interesting point is that from both Bob and Eve's 
points of view, it does not change anything whether a 
random phase shift is applied. In particular, the value 
of x(y '■ E) quantifying the information that Eve can 
acquire about the raw key in a reverse reconciliation sce- 
nario does not depend on the value of the phase noise. 
Note that this statement would not be true in a direct 
reconciliation scenario where the raw key would corre- 
spond to Alice's noisy data. 

Let us suppose that the quantum channel between Al- 
ice and Bob is characterized by its transmittance T and 
excess noise £. The covariance matrix Tab of the bipar- 
tite state shared by Alice and Bob after the quantum 
channel is then given by: 



Tab = 



V A l2 VkTW(j z 
^TW<j z (T(Vk-l) + l+T£)l 2 



(37) 



If they were not taking phase noise into account (that 
is, if k was equal to 1), Alice and Bob would estimate a 
transmittance T" and an excess noise £' such that 



T = Tk 

T'(V a - 1) + 1 + T'i 1 = T(V A - 1) + 1 



that is 



T =T'/k 

€ =£'-(i-«)(v A -i) 



(38) 



(39) 



If the phase noise parameter k is known, one can es- 
timate the covariance matrix as usual, hence obtaining 
values (T",£') and use the formula above to deduce the 
parameters (T, £) that can be used instead to compute 
Eve's information x{y '■ E). 

For this technique to work, it is necessary to be able 
to measure k = (E[cos9}) 2 experimentally. This is dis- 
cussed in the next section. 



B. Experimental evaluation of the phase noise 

The evaluation of the phase noise can be performed 
with a phase sensitive apparatus which allows us to com- 
pute an estimate of the noise between a signal whose 
quadratures are modulated following a chosen sequence 
and the outputs of some chosen quadrature measure- 
ments. A homodyne or heterodyne detection can be used 
for this purpose. 

Similarly to what is done on Bob's side when the ho- 
modyne detection efficiency and the variance of the elec- 
tronic noise are calibrated, it is necessary to assume that 
the calibration of the phase noise is performed in a safe 
place, i.e. that Eve cannot interfere with Alice's appara- 
tus during the phase noise measurement. The measure- 
ment can also be performed during a run of the protocol 
but one still needs to assume that Eve cannot interfere 
with Alice's device. This is crucial since overestimating 
the phase noise would lead to an overestimation of the 
secret key rate. 



Here, we are interested in the phase noise in the 
prepare-and-measure version of the protocol. The pro- 
cedure to estimate it goes as follows: Alice modulates 
as usual with a bivariate Gaussian distribution and she 
measures either one of the quadratures with a homodyne 
detection. Computing the variance of her measurement 
outcomes allows here to infer the quantity k introduced 
above. Let us denote by <j) the random variable corre- 
sponding to the angle between the modulated state and 
the measured quadrature and by B the random variable 
corresponding to the noise. This means for example that 
Alice prepared the state centered in Ae 1 ^ (with A > 0) 
and that the outcome of her q-quadrature measurement 
was Acos(j> + B. This noise B can be decomposed into 
the sum of a component orthogonal to the signal and a 
component parallel to the signal: 



B = Bn cos <j> + B± sin < 



(40) 



where we assume that B» and B± are independent of <f>. 
Figure [3] gives an illustration of this decomposition. We 
can easily build estimators of B\\ and B± (in the follow- 
ing, E[X] and V[X] refer respectively to the expectation 
and variance of the random variable X): 



V[Bcos4>] = V[B\\ cos 2 4>] - 
= ^[Bii]S[cos 4 . 



= 3/8F[Sy] + 1/8V[B ± ] 
V [B sin <j)\ = 1/8VIBJ +i/W[B\\] 



V[-Bl cos sin 0] (41) 

] +V[B 1 _]E[cos 2 c/)sm 2 (/>} 

(42) 

(43) 

(44) 

Since both V[B cos <fi] and V[B sin cj>] can be measured 
experimentally, one therefore has access to the values of 
F[-B_i_] and V[.B||]. Here, we assume that the only sources 
of noise are the shot noise and the phase noise. We as- 
sume that B± can be fully described by the shot noise 
and the phase noise: 

V[B_l] = N Q + V[Aamff\ = N + E[sin 2 6]E[A 2 ] (45) 



E[A 2 ] = ^ ^ 

where A is the amplitude of the modulated signal and 
where we used -E[sin#] = 0. The assumption of a small 
phase noise, i.e. small values of 6, gives: 

E[cos6}= E[l-9 2 /2] (47) 
1 



1 



-Ei 



(48) 



Figure [4] compares the so-called realistic and paranoid 
models. We consider a pessimistic scenario where the ex- 
cess noise on Alice's side is about 2.5% of the shot noise 
(the detector quantum efficiency and electronic noise are 
not taken into account here, for clarity). For a modu- 
lation variance Va — 2.5, we measured experimentally 
Ei = 3 10 -3 with a system similar to the one described 
in [20] . This leads to a realistic value of the excess noise 
Crcai = 1-75%. The result on the secret key rate for collec- 
tive attacks is an increased achievable distance by about 
40 km. 



9 



P t 




B — Bu cos 4> + B±_ sin 4> 

Figure 3: Experimental evaluation of the phase noise. The 
noise B before Bob's measurement can be decomposed into 
the sum of a component orthogonal to the signal Bi and a 
component parallel to the signal By. The result of Bob's q- 
quadrature measurement is A cos <f> + B where Alice prepared 
the state centered in Ae 1 ^ with A > 0. 





realistic — 




paranoid 







20 40 60 80 100 120 140 160 

d (km) 



Figure 4: Secret key rate for collective attacks in the asymp- 
totic regime. The plot at the top is obtained in the so-called 
realistic model where the phase noise is calibrated and is con- 
sidered as a local noise useless to the eavesdropper. The plot 
at the bottom corresponds to the so-called paranoid model 
where all the sources of noise are attributed to the eavesdrop- 
per. The transmittance T and distance d are linked with the 
expression T = io- Qd / 10 , where a is the loss coefficient of the 
optical fiber. V A = 2.5, £ = 0.025, a = 0.2 dB/km, = 95%, 
Ei = 3 10" 3 . 
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